@neohm/nestend 4.1.1 → 5.0.0

package/dist/auth/services/tenant.membership.service.js

@@ -8,24 +8,22 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+var TenantMembershipService_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TenantMembershipService = void 0;
 const common_1 = require("@nestjs/common");
 const typeorm_1 = require("typeorm");
 const access_exception_1 = require("../../global/exceptions/access.exception");
 const not_found_exception_1 = require("../../global/exceptions/not.found.exception");
-const operation_exception_1 = require("../../global/exceptions/operation.exception");
 const tenant_entity_1 = require("../../tenant/entities/tenant.entity");
 const system_role_entity_1 = require("../entities/system.role.entity");
 const tenant_user_entity_1 = require("../entities/tenant.user.entity");
 const user_entity_1 = require("../entities/user.entity");
-const user_role_entity_1 = require("../entities/user.role.entity");
-const tenant_role_enum_1 = require("../enums/tenant.role.enum");
 const user_type_enum_1 = require("../enums/user.type.enum");
 const access_revocation_1 = require("../utilities/access.revocation");
 const tenant_access_1 = require("../utilities/tenant.access");
 const auth_service_1 = require("./auth.service");
-let TenantMembershipService = class TenantMembershipService {
+let TenantMembershipService = TenantMembershipService_1 = class TenantMembershipService {
     constructor(authService, dataSource) {
         this.authService = authService;
         this.dataSource = dataSource;
@@ -58,11 +56,13 @@ let TenantMembershipService = class TenantMembershipService {
     async switchOrganization(dto, context) {
         const { user } = await this.authService.validateRole();
         this.assertTenantUser(user);
+        TenantMembershipService_1.assertOwnRefreshToken(dto.refresh_token, user.id);
         const organizations = await this.organizationsOf(user.id);
         const tenant = organizations.find((organization) => organization.id === dto.tenant_id);
         if (!tenant)
-            throw new access_exception_1.AccessException('You are not a member of this organization.');
-        await this.authService.logout(dto.refresh_token);
+            throw new not_found_exception_1.NotFoundException('No organization exists for this id');
+        if (!(await this.authService.logout(dto.refresh_token)))
+            throw new common_1.UnauthorizedException('Invalid refresh token');
         await this.userRepository.update({ id: user.id }, { organization_id: tenant.id });
         const tokens = await this.authService.issueTokens(user, {
             ...context,
@@ -73,9 +73,12 @@ let TenantMembershipService = class TenantMembershipService {
     async leave(tenantId, dto, context) {
         const { user } = await this.authService.validateRole();
         this.assertTenantUser(user);
-        await this.requireMembership(user.id, tenantId);
-        await this.assertAdminRemains(tenantId, user.id);
-        await this.dataSource.transaction((trx) => tenant_access_1.TenantAccess.remove(trx, user.id, tenantId));
+        TenantMembershipService_1.assertOwnRefreshToken(dto.refresh_token, user.id);
+        await this.dataSource.transaction(async (trx) => {
+            await this.requireMembership(trx, user.id, tenantId);
+            await tenant_access_1.TenantAccess.assertAdminRemains(trx, tenantId, user.id);
+            await tenant_access_1.TenantAccess.remove(trx, user.id, tenantId, user.id);
+        });
         await this.authService.logout(dto.refresh_token);
         const row = await this.userRepository.findOneByOrFail({ id: user.id });
         return this.authService.issueTokens(row, {
@@ -84,18 +87,23 @@ let TenantMembershipService = class TenantMembershipService {
         });
     }
     async setMemberRoles(userId, tenantId, roleIds, actorId, guardAdmin = true) {
-        await this.requireMembership(userId, tenantId);
         await this.assertLiveRoles(roleIds);
-        if (guardAdmin)
-            await this.assertAdminRemains(tenantId, userId, roleIds);
-        await this.dataSource.transaction((trx) => tenant_access_1.TenantAccess.reconcileRoles(trx, userId, tenantId, roleIds, actorId));
-        return this.authService.tenantRoles(userId, tenantId);
+        await this.dataSource.transaction(async (trx) => {
+            await this.requireMembership(trx, userId, tenantId);
+            if (guardAdmin)
+                await tenant_access_1.TenantAccess.assertAdminRemains(trx, tenantId, userId, roleIds);
+            await tenant_access_1.TenantAccess.reconcileRoles(trx, userId, tenantId, roleIds, actorId);
+        });
+        return tenant_access_1.TenantAccess.activeRoles(this.dataSource.manager, userId, tenantId);
     }
     async removeMember(userId, tenantId, actorId, guardAdmin = true) {
-        const membership = await this.requireMembership(userId, tenantId);
-        if (guardAdmin)
-            await this.assertAdminRemains(tenantId, userId);
-        await this.dataSource.transaction((trx) => tenant_access_1.TenantAccess.remove(trx, userId, tenantId));
+        const membership = await this.dataSource.transaction(async (trx) => {
+            const found = await this.requireMembership(trx, userId, tenantId);
+            if (guardAdmin)
+                await tenant_access_1.TenantAccess.assertAdminRemains(trx, tenantId, userId);
+            await tenant_access_1.TenantAccess.remove(trx, userId, tenantId, actorId);
+            return found;
+        });
         return { id: membership.id, deleted: true, deleted_by: actorId };
     }
     async assertLiveRoles(roleIds) {
@@ -116,47 +124,40 @@ let TenantMembershipService = class TenantMembershipService {
             });
     }
     async setMemberActive(userId, tenantId, active, actorId, guardAdmin = true) {
-        const membership = await this.requireMembership(userId, tenantId);
-        if (!active && guardAdmin)
-            await this.assertAdminRemains(tenantId, userId);
-        await this.dataSource.transaction(async (trx) => {
-            await trx.update(tenant_user_entity_1.TenantUserEntity, { id: membership.id }, { is_active: active, ...(actorId ? { updated_by: actorId } : {}) });
-            if (!active)
+        const membership = await this.dataSource.transaction(async (trx) => {
+            const found = await this.requireMembership(trx, userId, tenantId);
+            if (!active && guardAdmin)
+                await tenant_access_1.TenantAccess.assertAdminRemains(trx, tenantId, userId);
+            await trx.update(tenant_user_entity_1.TenantUserEntity, { id: found.id }, { is_active: active, ...(actorId ? { updated_by: actorId } : {}) });
+            if (!active) {
                 await access_revocation_1.AccessRevocation.revokeTenant(trx, userId, tenantId);
+                await tenant_access_1.TenantAccess.revokeInvitationsBy(trx, userId, tenantId, actorId);
+            }
+            return found;
         });
         return this.dataSource
             .getRepository(tenant_user_entity_1.TenantUserEntity)
             .findOneByOrFail({ id: membership.id });
     }
-    async requireMembership(userId, tenantId) {
-        const membership = await this.dataSource
-            .getRepository(tenant_user_entity_1.TenantUserEntity)
-            .findOne({ where: { user_id: userId, tenant_id: tenantId } });
+    async requireMembership(manager, userId, tenantId) {
+        const membership = await manager.findOne(tenant_user_entity_1.TenantUserEntity, {
+            where: { user_id: userId, tenant_id: tenantId },
+        });
         if (!membership)
             throw new not_found_exception_1.NotFoundException('No such member of this organization');
         return membership;
     }
-    async assertAdminRemains(tenantId, userId, nextRoleIds) {
-        const adminRole = await this.dataSource
-            .getRepository(system_role_entity_1.SystemRoleEntity)
-            .findOne({ where: { identifier: tenant_role_enum_1.TenantRole.GLOBAL_ADMIN } });
-        if (!adminRole)
-            return;
-        if (nextRoleIds?.includes(adminRole.id))
-            return;
-        const admins = await this.dataSource
-            .getRepository(user_role_entity_1.UserRoleEntity)
-            .createQueryBuilder('ur')
-            .innerJoin(tenant_user_entity_1.TenantUserEntity, 'tu', 'tu.user_id = ur.user_id and tu.tenant_id = ur.tenant_id and tu.deleted_at is null and tu.is_active = true')
-            .innerJoin(user_entity_1.UserEntity, 'u', 'u.id = ur.user_id and u.deleted_at is null')
-            .select('ur.user_id', 'user_id')
-            .where('ur.tenant_id = :tenantId', { tenantId })
-            .andWhere('ur.role_id = :roleId', { roleId: adminRole.id })
-            .distinct(true)
-            .getRawMany();
-        const isAdmin = admins.some((admin) => admin.user_id === userId);
-        if (isAdmin && admins.length === 1)
-            throw new operation_exception_1.OperationException('The organization needs at least one global.admin.');
+    static assertOwnRefreshToken(rawRefreshToken, userId) {
+        let subject;
+        try {
+            const [, payload] = rawRefreshToken.split('.');
+            subject = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8')).sub;
+        }
+        catch {
+            subject = undefined;
+        }
+        if (subject !== userId)
+            throw new common_1.UnauthorizedException('Invalid refresh token');
     }
     assertTenantUser(user) {
         if (user.user_type === user_type_enum_1.UserType.SYSTEM_USER)
@@ -170,7 +171,7 @@ let TenantMembershipService = class TenantMembershipService {
     }
 };
 exports.TenantMembershipService = TenantMembershipService;
-exports.TenantMembershipService = TenantMembershipService = __decorate([
+exports.TenantMembershipService = TenantMembershipService = TenantMembershipService_1 = __decorate([
     (0, common_1.Injectable)(),
     __metadata("design:paramtypes", [auth_service_1.AuthService,
         typeorm_1.DataSource])

package/dist/auth/services/tenant.membership.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.membership.service.js","sourceRoot":"","sources":["../../../src/auth/services/tenant.membership.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAiE;AACjE,qCAAqD;AACrD,+EAA2E;AAC3E,qFAAgF;AAChF,qFAAiF;AAEjF,uEAAmE;AAGnE,uEAAkE;AAClE,uEAAkE;AAClE,yDAAqD;AACrD,mEAA8D;AAC9D,gEAAuD;AACvD,4DAAmD;AAOnD,sEAAkE;AAClE,8DAA0D;AAC1D,iDAA6C;AAQtC,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAClC,YACmB,WAAwB,EACxB,UAAsB;QADtB,gBAAW,GAAX,WAAW,CAAa;QACxB,eAAU,GAAV,UAAU,CAAY;IACtC,CAAC;IAGJ,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,OAAO,IAAI,CAAC,gBAAgB;aACzB,kBAAkB,CAAC,GAAG,CAAC;aACvB,MAAM,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;aAClD,SAAS,CACR,qCAAgB,EAChB,IAAI,EACJ,uEAAuE,CACxE;aACA,KAAK,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,CAAC;aACzC,QAAQ,CAAC,oBAAoB,CAAC;aAC9B,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC;aACxB,OAAO,EAAE,CAAC;IACf,CAAC;IAMD,KAAK,CAAC,mBAAmB,CACvB,IAAgB;QAEhB,IAAI,CAAC,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC;QACvC,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YACnC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,eAAe,EAAE;YACnC,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;SAC7D,CAAC,CAAC;IACL,CAAC;IAOD,KAAK,CAAC,aAAa,CAAC,IAAgB;QAClC,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAQ,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QAE9D,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CACnC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,eAAe,CAC/C,CAAC;QACF,OAAO,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC9C,CAAC;IAOD,KAAK,CAAC,kBAAkB,CACtB,GAA0B,EAC1B,OAA2B;QAE3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QACvD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAE5B,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAC/B,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,KAAK,GAAG,CAAC,SAAS,CACpD,CAAC;QACF,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,kCAAe,CAAC,4CAA4C,CAAC,CAAC;QAE1E,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACjD,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAC9B,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EACf,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,EAAE,CAC/B,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE;YACtD,GAAG,OAAO;YACV,SAAS,EAAE,MAAM,CAAC,EAAE;SACrB,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACvE,CAAC;IAOD,KAAK,CAAC,KAAK,CACT,QAAgB,EAChB,GAAoB,EACpB,OAA2B;QAE3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QACvD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAEjD,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,EAAE,CACxC,4BAAY,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAC5C,CAAC;QACF,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAEjD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,EAAE;YACvC,GAAG,OAAO;YACV,SAAS,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;SACzC,CAAC,CAAC;IACL,CAAC;IAMD,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,QAAgB,EAChB,OAAiB,EACjB,OAAgB,EAChB,UAAU,GAAG,IAAI;QAEjB,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC/C,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,UAAU;YAAE,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAEzE,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,EAAE,CACxC,4BAAY,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CACrE,CAAC;QACF,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxD,CAAC;IAMD,KAAK,CAAC,YAAY,CAChB,MAAc,EACd,QAAgB,EAChB,OAAe,EACf,UAAU,GAAG,IAAI;QAEjB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClE,IAAI,UAAU;YAAE,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAEhE,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,EAAE,CACxC,4BAAY,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAC3C,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IACnE,CAAC;IAGO,KAAK,CAAC,eAAe,CAAC,OAAiB;QAC7C,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO;QAE3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU;aAChC,aAAa,CAAC,qCAAgB,CAAC;aAC/B,MAAM,CAAC,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,MAAM;YAChB,MAAM,IAAI,4BAAmB,CAAC;gBAC5B,OAAO,EAAE,mBAAmB;gBAC5B,MAAM,EAAE;oBACN,QAAQ,EAAE,OAAO,CAAC,GAAG,CACnB,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,MAAM,yBAAyB,CACrD;iBACF;aACF,CAAC,CAAC;IACP,CAAC;IAOD,KAAK,CAAC,eAAe,CACnB,MAAc,EACd,QAAgB,EAChB,MAAe,EACf,OAAgB,EAChB,UAAU,GAAG,IAAI;QAEjB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,IAAI,UAAU;YAAE,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAE3E,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC9C,MAAM,GAAG,CAAC,MAAM,CACd,qCAAgB,EAChB,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,EACrB,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CACnE,CAAC;YACF,IAAI,CAAC,MAAM;gBAAE,MAAM,oCAAgB,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,UAAU;aACnB,aAAa,CAAC,qCAAgB,CAAC;aAC/B,eAAe,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,MAAc,EACd,QAAgB;QAEhB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU;aACrC,aAAa,CAAC,qCAAgB,CAAC;aAC/B,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,UAAU;YACb,MAAM,IAAI,uCAAiB,CAAC,qCAAqC,CAAC,CAAC;QACrE,OAAO,UAAU,CAAC;IACpB,CAAC;IAOO,KAAK,CAAC,kBAAkB,CAC9B,QAAgB,EAChB,MAAc,EACd,WAAsB;QAEtB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU;aACpC,aAAa,CAAC,qCAAgB,CAAC;aAC/B,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,6BAAU,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,SAAS;YAAE,OAAO;QACvB,IAAI,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAAE,OAAO;QAEhD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU;aACjC,aAAa,CAAC,iCAAc,CAAC;aAC7B,kBAAkB,CAAC,IAAI,CAAC;aACxB,SAAS,CACR,qCAAgB,EAChB,IAAI,EACJ,2GAA2G,CAC5G;aACA,SAAS,CAAC,wBAAU,EAAE,GAAG,EAAE,4CAA4C,CAAC;aACxE,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC;aAC/B,KAAK,CAAC,0BAA0B,EAAE,EAAE,QAAQ,EAAE,CAAC;aAC/C,QAAQ,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC;aAC1D,QAAQ,CAAC,IAAI,CAAC;aACd,UAAU,EAAuB,CAAC;QAErC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC;QACjE,IAAI,OAAO,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAChC,MAAM,IAAI,wCAAkB,CAC1B,mDAAmD,CACpD,CAAC;IACN,CAAC;IAEO,gBAAgB,CAAC,IAAgB;QACvC,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAQ,CAAC,WAAW;YACzC,MAAM,IAAI,kCAAe,CACvB,+EAA+E,CAChF,CAAC;IACN,CAAC;IAED,IAAY,gBAAgB;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,4BAAY,CAAC,CAAC;IACrD,CAAC;IAED,IAAY,cAAc;QACxB,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,wBAAU,CAAC,CAAC;IACnD,CAAC;CACF,CAAA;AAvQY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;qCAGqB,0BAAW;QACZ,oBAAU;GAH9B,uBAAuB,CAuQnC"}
+{"version":3,"file":"tenant.membership.service.js","sourceRoot":"","sources":["../../../src/auth/services/tenant.membership.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAIwB;AACxB,qCAAoE;AACpE,+EAA2E;AAC3E,qFAAgF;AAEhF,uEAAmE;AAGnE,uEAAkE;AAClE,uEAAkE;AAClE,yDAAqD;AACrD,4DAAmD;AAOnD,sEAAkE;AAClE,8DAA0D;AAC1D,iDAA6C;AAQtC,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAClC,YACmB,WAAwB,EACxB,UAAsB;QADtB,gBAAW,GAAX,WAAW,CAAa;QACxB,eAAU,GAAV,UAAU,CAAY;IACtC,CAAC;IAGJ,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,OAAO,IAAI,CAAC,gBAAgB;aACzB,kBAAkB,CAAC,GAAG,CAAC;aACvB,MAAM,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;aAClD,SAAS,CACR,qCAAgB,EAChB,IAAI,EACJ,uEAAuE,CACxE;aACA,KAAK,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,CAAC;aACzC,QAAQ,CAAC,oBAAoB,CAAC;aAC9B,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC;aACxB,OAAO,EAAE,CAAC;IACf,CAAC;IAMD,KAAK,CAAC,mBAAmB,CACvB,IAAgB;QAEhB,IAAI,CAAC,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC;QACvC,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YACnC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,eAAe,EAAE;YACnC,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;SAC7D,CAAC,CAAC;IACL,CAAC;IAOD,KAAK,CAAC,aAAa,CAAC,IAAgB;QAClC,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAQ,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QAE9D,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CACnC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,eAAe,CAC/C,CAAC;QACF,OAAO,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC9C,CAAC;IAOD,KAAK,CAAC,kBAAkB,CACtB,GAA0B,EAC1B,OAA2B;QAE3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QACvD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5B,yBAAuB,CAAC,qBAAqB,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAE1E,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAC/B,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,KAAK,GAAG,CAAC,SAAS,CACpD,CAAC;QAEF,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,uCAAiB,CAAC,oCAAoC,CAAC,CAAC;QAEpE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACrD,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAC9B,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EACf,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,EAAE,CAC/B,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE;YACtD,GAAG,OAAO;YACV,SAAS,EAAE,MAAM,CAAC,EAAE;SACrB,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACvE,CAAC;IAOD,KAAK,CAAC,KAAK,CACT,QAAgB,EAChB,GAAoB,EACpB,OAA2B;QAE3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QACvD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5B,yBAAuB,CAAC,qBAAqB,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAE1E,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC9C,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YACrD,MAAM,4BAAY,CAAC,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9D,MAAM,4BAAY,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAEjD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,EAAE;YACvC,GAAG,OAAO;YACV,SAAS,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;SACzC,CAAC,CAAC;IACL,CAAC;IAMD,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,QAAgB,EAChB,OAAiB,EACjB,OAAgB,EAChB,UAAU,GAAG,IAAI;QAEjB,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAEpC,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC9C,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACpD,IAAI,UAAU;gBACZ,MAAM,4BAAY,CAAC,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YACxE,MAAM,4BAAY,CAAC,cAAc,CAC/B,GAAG,EACH,MAAM,EACN,QAAQ,EACR,OAAO,EACP,OAAO,CACR,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,OAAO,4BAAY,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7E,CAAC;IAMD,KAAK,CAAC,YAAY,CAChB,MAAc,EACd,QAAgB,EAChB,OAAgB,EAChB,UAAU,GAAG,IAAI;QAEjB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACjE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YAClE,IAAI,UAAU;gBACZ,MAAM,4BAAY,CAAC,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC/D,MAAM,4BAAY,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IACnE,CAAC;IAGO,KAAK,CAAC,eAAe,CAAC,OAAiB;QAC7C,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO;QAE3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU;aAChC,aAAa,CAAC,qCAAgB,CAAC;aAC/B,MAAM,CAAC,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,MAAM;YAChB,MAAM,IAAI,4BAAmB,CAAC;gBAC5B,OAAO,EAAE,mBAAmB;gBAC5B,MAAM,EAAE;oBACN,QAAQ,EAAE,OAAO,CAAC,GAAG,CACnB,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,MAAM,yBAAyB,CACrD;iBACF;aACF,CAAC,CAAC;IACP,CAAC;IAOD,KAAK,CAAC,eAAe,CACnB,MAAc,EACd,QAAgB,EAChB,MAAe,EACf,OAAgB,EAChB,UAAU,GAAG,IAAI;QAEjB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACjE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YAClE,IAAI,CAAC,MAAM,IAAI,UAAU;gBACvB,MAAM,4BAAY,CAAC,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAE/D,MAAM,GAAG,CAAC,MAAM,CACd,qCAAgB,EAChB,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,EAChB,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CACnE,CAAC;YACF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,oCAAgB,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC3D,MAAM,4BAAY,CAAC,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,UAAU;aACnB,aAAa,CAAC,qCAAgB,CAAC;aAC/B,eAAe,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,OAAsB,EACtB,MAAc,EACd,QAAgB;QAEhB,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,qCAAgB,EAAE;YACzD,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE;SAChD,CAAC,CAAC;QACH,IAAI,CAAC,UAAU;YACb,MAAM,IAAI,uCAAiB,CAAC,qCAAqC,CAAC,CAAC;QACrE,OAAO,UAAU,CAAC;IACpB,CAAC;IAMD,MAAM,CAAC,qBAAqB,CAAC,eAAuB,EAAE,MAAc;QAClE,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/C,OAAO,GACL,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAG9D,CAAC,GAAG,CAAC;QACR,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC;QACD,IAAI,OAAO,KAAK,MAAM;YACpB,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;IAC7D,CAAC;IAEO,gBAAgB,CAAC,IAAgB;QACvC,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAQ,CAAC,WAAW;YACzC,MAAM,IAAI,kCAAe,CACvB,+EAA+E,CAChF,CAAC;IACN,CAAC;IAED,IAAY,gBAAgB;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,4BAAY,CAAC,CAAC;IACrD,CAAC;IAED,IAAY,cAAc;QACxB,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,wBAAU,CAAC,CAAC;IACnD,CAAC;CACF,CAAA;AAvQY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;qCAGqB,0BAAW;QACZ,oBAAU;GAH9B,uBAAuB,CAuQnC"}

package/dist/auth/services/token.service.d.ts

@@ -0,0 +1,30 @@
+import { JwtService } from '@nestjs/jwt';
+import { DataSource } from 'typeorm';
+import { SystemRefreshTokenEntity } from '../entities/system.refresh.token.entity';
+import { IssuedSession, IssueSessionOptions, JwtPayload, JwtRefreshPayload, RefreshRejection, ResolvedSession, RotatedRefreshToken, TokenAudience } from '../types/auth.types';
+import { AuthConfig } from '../utilities/auth.config';
+export declare class TokenService {
+    private readonly jwtService;
+    private readonly dataSource;
+    private readonly config;
+    private readonly logger;
+    constructor(jwtService: JwtService, dataSource: DataSource, config: AuthConfig);
+    issue(audience: TokenAudience, principalId: string, options?: IssueSessionOptions & {
+        tenantId?: string | null;
+    }): Promise<IssuedSession>;
+    verify(type: 'access', audience: TokenAudience, token: string): Promise<JwtPayload | null>;
+    verify(type: 'refresh', audience: TokenAudience, token: string): Promise<JwtRefreshPayload | null>;
+    resolveSession(audience: TokenAudience, token: string): Promise<ResolvedSession | null>;
+    checkSession(audience: TokenAudience, payload: JwtPayload): Promise<ResolvedSession | null>;
+    rotate(audience: TokenAudience, rawRefreshToken: string, options: IssueSessionOptions, recheck: (consumed: RotatedRefreshToken) => Promise<{
+        tenantId?: string | null;
+    } | void>): Promise<IssuedSession>;
+    revokeRefreshToken(audience: TokenAudience, rawRefreshToken: string, principalId: string): Promise<boolean>;
+    invalidateSession(audience: TokenAudience, sessionIdentifier: string, principalId?: string): Promise<void>;
+    static hashToken(token: string): string;
+    static rejection(row: Pick<SystemRefreshTokenEntity, 'revoked_at' | 'expires_at' | 'attributes'> | null, now?: Date): RefreshRejection;
+    private static hasClaims;
+    private rejectRefresh;
+    private sign;
+}
+//# sourceMappingURL=token.service.d.ts.map

package/dist/auth/services/token.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.service.d.ts","sourceRoot":"","sources":["../../../src/auth/services/token.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAU,MAAM,SAAS,CAAC;AAE7C,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,aAAa,EAEd,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAQtD,qBACa,YAAY;IAIrB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM;IALzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;gBAGrC,UAAU,EAAE,UAAU,EACtB,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,UAAU;IAI/B,KAAK,CACT,QAAQ,EAAE,aAAa,EACvB,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,mBAAmB,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAO,GAC/D,OAAO,CAAC,aAAa,CAAC;IA4DnB,MAAM,CACV,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,aAAa,EACvB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IACvB,MAAM,CACV,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,aAAa,EACvB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAuB9B,cAAc,CAClB,QAAQ,EAAE,aAAa,EACvB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAM5B,YAAY,CAChB,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAgC5B,MAAM,CACV,QAAQ,EAAE,aAAa,EACvB,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,mBAAmB,EAC5B,OAAO,EAAE,CACP,QAAQ,EAAE,mBAAmB,KAC1B,OAAO,CAAC;QAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,GAChD,OAAO,CAAC,aAAa,CAAC;IAyCnB,kBAAkB,CACtB,QAAQ,EAAE,aAAa,EACvB,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC;IAiBb,iBAAiB,CACrB,QAAQ,EAAE,aAAa,EACvB,iBAAiB,EAAE,MAAM,EACzB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC;IAYhB,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAKvC,MAAM,CAAC,SAAS,CACd,GAAG,EAAE,IAAI,CACP,wBAAwB,EACxB,YAAY,GAAG,YAAY,GAAG,YAAY,CAC3C,GAAG,IAAI,EACR,GAAG,OAAa,GACf,gBAAgB;IAQnB,OAAO,CAAC,MAAM,CAAC,SAAS;YAaV,aAAa;IA0B3B,OAAO,CAAC,IAAI;CAiBb"}

package/dist/auth/services/token.service.js

@@ -0,0 +1,211 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var TokenService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenService = void 0;
+const common_1 = require("@nestjs/common");
+const jwt_1 = require("@nestjs/jwt");
+const crypto_1 = require("crypto");
+const typeorm_1 = require("typeorm");
+const system_auth_session_entity_1 = require("../entities/system.auth.session.entity");
+const system_refresh_token_entity_1 = require("../entities/system.refresh.token.entity");
+const access_revocation_1 = require("../utilities/access.revocation");
+const auth_config_1 = require("../utilities/auth.config");
+const auth_message_enum_1 = require("../enums/auth.message.enum");
+let TokenService = TokenService_1 = class TokenService {
+    constructor(jwtService, dataSource, config) {
+        this.jwtService = jwtService;
+        this.dataSource = dataSource;
+        this.config = config;
+        this.logger = new common_1.Logger(TokenService_1.name);
+    }
+    async issue(audience, principalId, options = {}) {
+        const accessTtl = options.accessTtlSeconds ?? this.config.accessTokenTtlSeconds;
+        const sessionIdentifier = (0, crypto_1.randomBytes)(32).toString('hex');
+        const expiresAt = new Date(Date.now() + accessTtl * 1000);
+        const isAdmin = audience === 'admin';
+        const tenantId = isAdmin ? null : (options.tenantId ?? null);
+        const access_token = await this.sign('access', audience, { sub: principalId, sid: sessionIdentifier, jti: (0, crypto_1.randomUUID)() }, accessTtl);
+        const refresh_token = options.withRefreshToken === false
+            ? undefined
+            : await this.sign('refresh', audience, { sub: principalId, jti: (0, crypto_1.randomUUID)() }, this.config.refreshTokenTtlSeconds);
+        await this.dataSource.transaction(async (trx) => {
+            await trx.save(trx.create(system_auth_session_entity_1.SystemAuthSessionEntity, {
+                user_id: principalId,
+                is_admin: isAdmin,
+                tenant_id: tenantId,
+                session_identifier: sessionIdentifier,
+                expires_at: expiresAt,
+            }));
+            if (!refresh_token)
+                return;
+            await trx.save(trx.create(system_refresh_token_entity_1.SystemRefreshTokenEntity, {
+                user_id: principalId,
+                is_admin: isAdmin,
+                tenant_id: tenantId,
+                token_hash: TokenService_1.hashToken(refresh_token),
+                session_identifier: sessionIdentifier,
+                expires_at: new Date(Date.now() + this.config.refreshTokenTtlSeconds * 1000),
+                ip_address: options.context?.ip_address ?? null,
+                user_agent: options.context?.user_agent ?? null,
+            }));
+        });
+        return {
+            access_token,
+            ...(refresh_token ? { refresh_token } : {}),
+            session_identifier: sessionIdentifier,
+            expires_at: expiresAt,
+        };
+    }
+    async verify(type, audience, token) {
+        if (!token || typeof token !== 'string')
+            return null;
+        try {
+            const payload = await this.jwtService.verifyAsync(token, {
+                secret: this.config.signingKey(type, audience),
+                algorithms: ['HS256'],
+                audience,
+                issuer: this.config.issuer,
+            });
+            return TokenService_1.hasClaims(type, payload) ? payload : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    async resolveSession(audience, token) {
+        const payload = await this.verify('access', audience, token);
+        return payload ? this.checkSession(audience, payload) : null;
+    }
+    async checkSession(audience, payload) {
+        if (!TokenService_1.hasClaims('access', payload))
+            return null;
+        const session = await this.dataSource
+            .getRepository(system_auth_session_entity_1.SystemAuthSessionEntity)
+            .findOne({
+            where: {
+                session_identifier: payload.sid,
+                user_id: payload.sub,
+                is_admin: audience === 'admin',
+            },
+        });
+        if (!session ||
+            session.invalidated_at ||
+            session.expires_at.getTime() <= Date.now())
+            return null;
+        return {
+            payload,
+            sessionIdentifier: session.session_identifier,
+            tenantId: session.tenant_id ?? null,
+        };
+    }
+    async rotate(audience, rawRefreshToken, options, recheck) {
+        const payload = await this.verify('refresh', audience, rawRefreshToken);
+        if (!payload)
+            throw new common_1.UnauthorizedException(auth_message_enum_1.AuthMessage.INVALID_REFRESH);
+        const isAdmin = audience === 'admin';
+        const tokenHash = TokenService_1.hashToken(rawRefreshToken);
+        const result = await this.dataSource
+            .createQueryBuilder()
+            .update(system_refresh_token_entity_1.SystemRefreshTokenEntity)
+            .set({
+            revoked_at: () => 'now()',
+            attributes: () => `COALESCE(attributes, '{}'::jsonb) || '{"rotated": true}'::jsonb`,
+        })
+            .where('token_hash = :tokenHash AND user_id = :userId AND is_admin = :isAdmin' +
+            ' AND revoked_at IS NULL AND expires_at > now() AND deleted_at IS NULL', { tokenHash, userId: payload.sub, isAdmin })
+            .returning(['user_id', 'tenant_id', 'session_identifier'])
+            .execute();
+        const consumed = result.raw?.[0];
+        if (!consumed) {
+            await this.rejectRefresh(audience, payload.sub, tokenHash);
+            throw new common_1.UnauthorizedException(auth_message_enum_1.AuthMessage.INVALID_REFRESH);
+        }
+        if (consumed.session_identifier)
+            await this.invalidateSession(audience, consumed.session_identifier, payload.sub);
+        const overrides = (await recheck(consumed)) ?? {};
+        return this.issue(audience, payload.sub, { ...options, ...overrides });
+    }
+    async revokeRefreshToken(audience, rawRefreshToken, principalId) {
+        if (!rawRefreshToken || !principalId)
+            return false;
+        const result = await this.dataSource
+            .getRepository(system_refresh_token_entity_1.SystemRefreshTokenEntity)
+            .update({
+            token_hash: TokenService_1.hashToken(rawRefreshToken),
+            user_id: principalId,
+            is_admin: audience === 'admin',
+            revoked_at: (0, typeorm_1.IsNull)(),
+        }, { revoked_at: new Date() });
+        return (result.affected ?? 0) > 0;
+    }
+    async invalidateSession(audience, sessionIdentifier, principalId) {
+        await this.dataSource.getRepository(system_auth_session_entity_1.SystemAuthSessionEntity).update({
+            session_identifier: sessionIdentifier,
+            is_admin: audience === 'admin',
+            invalidated_at: (0, typeorm_1.IsNull)(),
+            ...(principalId ? { user_id: principalId } : {}),
+        }, { invalidated_at: new Date() });
+    }
+    static hashToken(token) {
+        return (0, crypto_1.createHash)('sha256').update(token).digest('hex');
+    }
+    static rejection(row, now = new Date()) {
+        if (!row)
+            return 'unknown';
+        if (row.revoked_at)
+            return row.attributes?.rotated === true ? 'reused' : 'revoked';
+        if (row.expires_at.getTime() <= now.getTime())
+            return 'expired';
+        return 'unknown';
+    }
+    static hasClaims(type, payload) {
+        return (!!payload &&
+            payload.typ === type &&
+            typeof payload.sub === 'string' &&
+            typeof payload.jti === 'string' &&
+            (type !== 'access' || typeof payload.sid === 'string'));
+    }
+    async rejectRefresh(audience, principalId, tokenHash) {
+        const isAdmin = audience === 'admin';
+        const row = await this.dataSource
+            .getRepository(system_refresh_token_entity_1.SystemRefreshTokenEntity)
+            .findOne({
+            where: {
+                token_hash: tokenHash,
+                user_id: principalId,
+                is_admin: isAdmin,
+            },
+            withDeleted: true,
+        });
+        if (TokenService_1.rejection(row) !== 'reused')
+            return;
+        this.logger.warn(`Refresh token reuse detected for ${audience} ${principalId}; revoking all sessions.`);
+        await this.dataSource.transaction((trx) => access_revocation_1.AccessRevocation.revokeAll(trx, principalId, isAdmin));
+    }
+    sign(type, audience, claims, ttlSeconds) {
+        return this.jwtService.signAsync({ ...claims, typ: type }, {
+            secret: this.config.signingKey(type, audience),
+            algorithm: 'HS256',
+            expiresIn: ttlSeconds,
+            audience,
+            issuer: this.config.issuer,
+        });
+    }
+};
+exports.TokenService = TokenService;
+exports.TokenService = TokenService = TokenService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [jwt_1.JwtService,
+        typeorm_1.DataSource,
+        auth_config_1.AuthConfig])
+], TokenService);
+//# sourceMappingURL=token.service.js.map

package/dist/auth/services/token.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.service.js","sourceRoot":"","sources":["../../../src/auth/services/token.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAA2E;AAC3E,qCAAyC;AACzC,mCAA6D;AAC7D,qCAA6C;AAC7C,uFAAiF;AACjF,yFAAmF;AAYnF,sEAAkE;AAClE,0DAAsD;AACtD,kEAAyD;AAQlD,IAAM,YAAY,oBAAlB,MAAM,YAAY;IAGvB,YACmB,UAAsB,EACtB,UAAsB,EACtB,MAAkB;QAFlB,eAAU,GAAV,UAAU,CAAY;QACtB,eAAU,GAAV,UAAU,CAAY;QACtB,WAAM,GAAN,MAAM,CAAY;QALpB,WAAM,GAAG,IAAI,eAAM,CAAC,cAAY,CAAC,IAAI,CAAC,CAAC;IAMrD,CAAC;IAGJ,KAAK,CAAC,KAAK,CACT,QAAuB,EACvB,WAAmB,EACnB,UAA8D,EAAE;QAEhE,MAAM,SAAS,GACb,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;QAChE,MAAM,iBAAiB,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,QAAQ,KAAK,OAAO,CAAC;QACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC;QAE7D,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,IAAI,CAClC,QAAQ,EACR,QAAQ,EACR,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,EAAE,IAAA,mBAAU,GAAE,EAAE,EAC/D,SAAS,CACV,CAAC;QACF,MAAM,aAAa,GACjB,OAAO,CAAC,gBAAgB,KAAK,KAAK;YAChC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CACb,SAAS,EACT,QAAQ,EACR,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,IAAA,mBAAU,GAAE,EAAE,EACvC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CACnC,CAAC;QAER,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC9C,MAAM,GAAG,CAAC,IAAI,CACZ,GAAG,CAAC,MAAM,CAAC,oDAAuB,EAAE;gBAClC,OAAO,EAAE,WAAW;gBACpB,QAAQ,EAAE,OAAO;gBACjB,SAAS,EAAE,QAAkB;gBAC7B,kBAAkB,EAAE,iBAAiB;gBACrC,UAAU,EAAE,SAAS;aACtB,CAAC,CACH,CAAC;YACF,IAAI,CAAC,aAAa;gBAAE,OAAO;YAC3B,MAAM,GAAG,CAAC,IAAI,CACZ,GAAG,CAAC,MAAM,CAAC,sDAAwB,EAAE;gBACnC,OAAO,EAAE,WAAW;gBACpB,QAAQ,EAAE,OAAO;gBACjB,SAAS,EAAE,QAAkB;gBAC7B,UAAU,EAAE,cAAY,CAAC,SAAS,CAAC,aAAa,CAAC;gBACjD,kBAAkB,EAAE,iBAAiB;gBACrC,UAAU,EAAE,IAAI,IAAI,CAClB,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,sBAAsB,GAAG,IAAI,CACvD;gBACD,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,IAAI,IAAI;gBAC/C,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,IAAI,IAAI;aACX,CAAC,CACxC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO;YACL,YAAY;YACZ,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,kBAAkB,EAAE,iBAAiB;YACrC,UAAU,EAAE,SAAS;SACtB,CAAC;IACJ,CAAC;IAaD,KAAK,CAAC,MAAM,CACV,IAAe,EACf,QAAuB,EACvB,KAAa;QAEb,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAE/C,KAAK,EAAE;gBACP,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC;gBAC9C,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,QAAQ;gBACR,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;aAC3B,CAAC,CAAC;YACH,OAAO,cAAY,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAGD,KAAK,CAAC,cAAc,CAClB,QAAuB,EACvB,KAAa;QAEb,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC7D,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,CAAC;IAGD,KAAK,CAAC,YAAY,CAChB,QAAuB,EACvB,OAAmB;QAEnB,IAAI,CAAC,cAAY,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAE5D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU;aAClC,aAAa,CAAC,oDAAuB,CAAC;aACtC,OAAO,CAAC;YACP,KAAK,EAAE;gBACL,kBAAkB,EAAE,OAAO,CAAC,GAAG;gBAC/B,OAAO,EAAE,OAAO,CAAC,GAAG;gBACpB,QAAQ,EAAE,QAAQ,KAAK,OAAO;aAC/B;SACF,CAAC,CAAC;QACL,IACE,CAAC,OAAO;YACR,OAAO,CAAC,cAAc;YACtB,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;YAE1C,OAAO,IAAI,CAAC;QAEd,OAAO;YACL,OAAO;YACP,iBAAiB,EAAE,OAAO,CAAC,kBAAkB;YAC7C,QAAQ,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;SACpC,CAAC;IACJ,CAAC;IAQD,KAAK,CAAC,MAAM,CACV,QAAuB,EACvB,eAAuB,EACvB,OAA4B,EAC5B,OAEiD;QAEjD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;QACxE,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,8BAAqB,CAAC,+BAAW,CAAC,eAAe,CAAC,CAAC;QAE3E,MAAM,OAAO,GAAG,QAAQ,KAAK,OAAO,CAAC;QACrC,MAAM,SAAS,GAAG,cAAY,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU;aACjC,kBAAkB,EAAE;aACpB,MAAM,CAAC,sDAAwB,CAAC;aAChC,GAAG,CAAC;YACH,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO;YACzB,UAAU,EAAE,GAAG,EAAE,CACf,iEAAiE;SACpE,CAAC;aACD,KAAK,CACJ,uEAAuE;YACrE,uEAAuE,EACzE,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,CAC5C;aACA,SAAS,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,oBAAoB,CAAC,CAAC;aACzD,OAAO,EAAE,CAAC;QAEb,MAAM,QAAQ,GAAI,MAAM,CAAC,GAAyC,EAAE,CAAC,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC3D,MAAM,IAAI,8BAAqB,CAAC,+BAAW,CAAC,eAAe,CAAC,CAAC;QAC/D,CAAC;QAGD,IAAI,QAAQ,CAAC,kBAAkB;YAC7B,MAAM,IAAI,CAAC,iBAAiB,CAC1B,QAAQ,EACR,QAAQ,CAAC,kBAAkB,EAC3B,OAAO,CAAC,GAAG,CACZ,CAAC;QAEJ,MAAM,SAAS,GAAG,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;IACzE,CAAC;IAGD,KAAK,CAAC,kBAAkB,CACtB,QAAuB,EACvB,eAAuB,EACvB,WAAmB;QAEnB,IAAI,CAAC,eAAe,IAAI,CAAC,WAAW;YAAE,OAAO,KAAK,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU;aACjC,aAAa,CAAC,sDAAwB,CAAC;aACvC,MAAM,CACL;YACE,UAAU,EAAE,cAAY,CAAC,SAAS,CAAC,eAAe,CAAC;YACnD,OAAO,EAAE,WAAW;YACpB,QAAQ,EAAE,QAAQ,KAAK,OAAO;YAC9B,UAAU,EAAE,IAAA,gBAAM,GAAE;SACrB,EACD,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAC3B,CAAC;QACJ,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAGD,KAAK,CAAC,iBAAiB,CACrB,QAAuB,EACvB,iBAAyB,EACzB,WAAoB;QAEpB,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,oDAAuB,CAAC,CAAC,MAAM,CACjE;YACE,kBAAkB,EAAE,iBAAiB;YACrC,QAAQ,EAAE,QAAQ,KAAK,OAAO;YAC9B,cAAc,EAAE,IAAA,gBAAM,GAAE;YACxB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,EACD,EAAE,cAAc,EAAE,IAAI,IAAI,EAAE,EAAE,CAC/B,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,SAAS,CAAC,KAAa;QAC5B,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAGD,MAAM,CAAC,SAAS,CACd,GAGQ,EACR,GAAG,GAAG,IAAI,IAAI,EAAE;QAEhB,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,IAAI,GAAG,CAAC,UAAU;YAChB,OAAO,GAAG,CAAC,UAAU,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE;YAAE,OAAO,SAAS,CAAC;QAChE,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,MAAM,CAAC,SAAS,CACtB,IAAe,EACf,OAAmE;QAEnE,OAAO,CACL,CAAC,CAAC,OAAO;YACT,OAAO,CAAC,GAAG,KAAK,IAAI;YACpB,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC/B,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC/B,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CACvD,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,QAAuB,EACvB,WAAmB,EACnB,SAAiB;QAEjB,MAAM,OAAO,GAAG,QAAQ,KAAK,OAAO,CAAC;QACrC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU;aAC9B,aAAa,CAAC,sDAAwB,CAAC;aACvC,OAAO,CAAC;YACP,KAAK,EAAE;gBACL,UAAU,EAAE,SAAS;gBACrB,OAAO,EAAE,WAAW;gBACpB,QAAQ,EAAE,OAAO;aAClB;YACD,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACL,IAAI,cAAY,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,QAAQ;YAAE,OAAO;QAErD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,oCAAoC,QAAQ,IAAI,WAAW,0BAA0B,CACtF,CAAC;QACF,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,EAAE,CACxC,oCAAgB,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,CACtD,CAAC;IACJ,CAAC;IAEO,IAAI,CACV,IAAe,EACf,QAAuB,EACvB,MAA8B,EAC9B,UAAkB;QAElB,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,CAC9B,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EACxB;YACE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC9C,SAAS,EAAE,OAAO;YAClB,SAAS,EAAE,UAAU;YACrB,QAAQ;YACR,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;SAC3B,CACF,CAAC;IACJ,CAAC;CACF,CAAA;AAtTY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;qCAKoB,gBAAU;QACV,oBAAU;QACd,wBAAU;GAN1B,YAAY,CAsTxB"}

package/dist/auth/strategy/jwt.refresh.strategy.d.ts

@@ -1,14 +1,13 @@
+import type { Request } from 'express';
 import { Strategy } from 'passport-jwt';
-import { JwtRefreshPayload } from '../types/auth.types';
+import { JwtRefreshPayload, RequestUser } from '../types/auth.types';
+import { AuthConfig } from '../utilities/auth.config';
 declare const JwtRefreshStrategy_base: new (...args: [opt: import("passport-jwt").StrategyOptionsWithRequest] | [opt: import("passport-jwt").StrategyOptionsWithoutRequest]) => Strategy & {
     validate(...args: any[]): unknown;
 };
 export declare class JwtRefreshStrategy extends JwtRefreshStrategy_base {
-    constructor();
-    validate(payload: JwtRefreshPayload): {
-        userId: string;
-        email: string;
-    };
+    constructor(config: AuthConfig);
+    validate(request: Request, payload: JwtRefreshPayload): Promise<RequestUser>;
 }
 export {};
 //# sourceMappingURL=jwt.refresh.strategy.d.ts.map

package/dist/auth/strategy/jwt.refresh.strategy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.refresh.strategy.d.ts","sourceRoot":"","sources":["../../../src/auth/strategy/jwt.refresh.strategy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAc,QAAQ,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;;;;AAExD,qBACa,kBAAmB,SAAQ,uBAGvC;;IAUC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;CAGxE"}
+{"version":3,"file":"jwt.refresh.strategy.d.ts","sourceRoot":"","sources":["../../../src/auth/strategy/jwt.refresh.strategy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAc,QAAQ,EAAE,MAAM,cAAc,CAAC;AAKpD,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;;;;AAStD,qBACa,kBAAmB,SAAQ,uBAGvC;gBACa,MAAM,EAAE,UAAU;IAYxB,QAAQ,CACZ,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,WAAW,CAAC;CAmBxB"}

package/dist/auth/strategy/jwt.refresh.strategy.js

@@ -13,22 +13,46 @@ exports.JwtRefreshStrategy = void 0;
 const common_1 = require("@nestjs/common");
 const passport_1 = require("@nestjs/passport");
 const passport_jwt_1 = require("passport-jwt");
+const typeorm_1 = require("typeorm");
+const system_refresh_token_entity_1 = require("../entities/system.refresh.token.entity");
+const user_entity_1 = require("../entities/user.entity");
+const token_service_1 = require("../services/token.service");
+const auth_config_1 = require("../utilities/auth.config");
+const extractRefreshToken = passport_jwt_1.ExtractJwt.fromBodyField('refresh_token');
 let JwtRefreshStrategy = class JwtRefreshStrategy extends (0, passport_1.PassportStrategy)(passport_jwt_1.Strategy, 'jwt-refresh') {
-    constructor() {
+    constructor(config) {
         super({
-            jwtFromRequest: passport_jwt_1.ExtractJwt.fromBodyField('refresh_token'),
+            jwtFromRequest: extractRefreshToken,
             ignoreExpiration: false,
-            secretOrKey: process.env.REFRESH_TOKEN_SECRET,
-            passReqToCallback: false,
+            secretOrKey: config.signingKey('refresh', 'user'),
+            algorithms: ['HS256'],
+            audience: 'user',
+            issuer: config.issuer,
+            passReqToCallback: true,
         });
     }
-    validate(payload) {
-        return { userId: payload.sub, email: payload.email };
+    async validate(request, payload) {
+        const raw = extractRefreshToken(request);
+        if (payload.typ !== 'refresh' || !raw)
+            throw new common_1.UnauthorizedException('Invalid refresh token');
+        const live = await system_refresh_token_entity_1.SystemRefreshTokenEntity.existsBy({
+            token_hash: token_service_1.TokenService.hashToken(raw),
+            user_id: payload.sub,
+            is_admin: false,
+            revoked_at: (0, typeorm_1.IsNull)(),
+            expires_at: (0, typeorm_1.MoreThan)(new Date()),
+        });
+        const user = live
+            ? await user_entity_1.UserEntity.findOne({ where: { id: payload.sub } })
+            : null;
+        if (!user?.active)
+            throw new common_1.UnauthorizedException('Invalid refresh token');
+        return { userId: user.id, email: user.email };
     }
 };
 exports.JwtRefreshStrategy = JwtRefreshStrategy;
 exports.JwtRefreshStrategy = JwtRefreshStrategy = __decorate([
     (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [])
+    __metadata("design:paramtypes", [auth_config_1.AuthConfig])
 ], JwtRefreshStrategy);
 //# sourceMappingURL=jwt.refresh.strategy.js.map

package/dist/auth/strategy/jwt.refresh.strategy.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.refresh.strategy.js","sourceRoot":"","sources":["../../../src/auth/strategy/jwt.refresh.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,+CAAoD;AACpD,+CAAoD;AAI7C,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,IAAA,2BAAgB,EACtD,uBAAQ,EACR,aAAa,CACd;IACC;QACE,KAAK,CAAC;YACJ,cAAc,EAAE,yBAAU,CAAC,aAAa,CAAC,eAAe,CAAC;YACzD,gBAAgB,EAAE,KAAK;YACvB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;YAC7C,iBAAiB,EAAE,KAAK;SACzB,CAAC,CAAC;IACL,CAAC;IAED,QAAQ,CAAC,OAA0B;QACjC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IACvD,CAAC;CACF,CAAA;AAhBY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;;GACA,kBAAkB,CAgB9B"}
+{"version":3,"file":"jwt.refresh.strategy.js","sourceRoot":"","sources":["../../../src/auth/strategy/jwt.refresh.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAmE;AACnE,+CAAoD;AAEpD,+CAAoD;AACpD,qCAA2C;AAC3C,yFAAmF;AACnF,yDAAqD;AACrD,6DAAyD;AAEzD,0DAAsD;AAEtD,MAAM,mBAAmB,GAAG,yBAAU,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;AAQ/D,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,IAAA,2BAAgB,EACtD,uBAAQ,EACR,aAAa,CACd;IACC,YAAY,MAAkB;QAC5B,KAAK,CAAC;YACJ,cAAc,EAAE,mBAAmB;YACnC,gBAAgB,EAAE,KAAK;YACvB,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC;YACjD,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,OAAgB,EAChB,OAA0B;QAE1B,MAAM,GAAG,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG;YACnC,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;QAE3D,MAAM,IAAI,GAAG,MAAM,sDAAwB,CAAC,QAAQ,CAAC;YACnD,UAAU,EAAE,4BAAY,CAAC,SAAS,CAAC,GAAG,CAAC;YACvC,OAAO,EAAE,OAAO,CAAC,GAAG;YACpB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,IAAA,gBAAM,GAAE;YACpB,UAAU,EAAE,IAAA,kBAAQ,EAAC,IAAI,IAAI,EAAE,CAAC;SACjC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,IAAI;YACf,CAAC,CAAC,MAAM,wBAAU,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1D,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,CAAC,IAAI,EAAE,MAAM;YAAE,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;QAE5E,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAChD,CAAC;CACF,CAAA;AAtCY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;qCAKS,wBAAU;GAJnB,kBAAkB,CAsC9B"}

package/dist/auth/strategy/jwt.strategy.d.ts

@@ -1,12 +1,13 @@
 import { Strategy } from 'passport-jwt';
-import { CacheService } from '../../common/services/cache.service';
+import { TokenService } from '../services/token.service';
 import { JwtPayload, RequestUser } from '../types/auth.types';
+import { AuthConfig } from '../utilities/auth.config';
 declare const JwtStrategy_base: new (...args: [opt: import("passport-jwt").StrategyOptionsWithRequest] | [opt: import("passport-jwt").StrategyOptionsWithoutRequest]) => Strategy & {
     validate(...args: any[]): unknown;
 };
 export declare class JwtStrategy extends JwtStrategy_base {
-    private readonly cacheService;
-    constructor(cacheService: CacheService);
+    private readonly tokenService;
+    constructor(tokenService: TokenService, config: AuthConfig);
     validate(payload: JwtPayload): Promise<RequestUser>;
 }
 export {};

package/dist/auth/strategy/jwt.strategy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.strategy.d.ts","sourceRoot":"","sources":["../../../src/auth/strategy/jwt.strategy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAc,QAAQ,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;;;;AAE9D,qBACa,WAAY,SAAQ,gBAAiC;IACpD,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAAZ,YAAY,EAAE,YAAY;IAQjD,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;CAS1D"}
+{"version":3,"file":"jwt.strategy.d.ts","sourceRoot":"","sources":["../../../src/auth/strategy/jwt.strategy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAc,QAAQ,EAAE,MAAM,cAAc,CAAC;AAGpD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;;;;AAOtD,qBACa,WAAY,SAAQ,gBAAiC;IAE9D,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAAZ,YAAY,EAAE,YAAY,EAC3C,MAAM,EAAE,UAAU;IAYd,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;CAoB1D"}